Black Hole Attack Detection and Prevention Using Stable Election Protocol-Based Clustering and Digital Signature Authentication in Mobile Ad Hoc Networks

Routing security in MANETs has received significant attention due to the protocol vulnerabilities that arise from decentralized control and cooperative forwarding. Prior countermeasures fall broadly into the following categories: cryptographic authentication, trust and incentive schemes, intrusion and anomaly detection, protocol-level modifications, and WSN/energy-aware adaptations. Below we summarize representative contributions and highlight remaining gaps.

Cryptographic authentication and key-exchange. Public-key and symmetric cryptographic schemes have been employed to ensure the authenticity and integrity of routing control messages. Password based key exchange systems as studied by Asokan et al. [7] enabled session setup without centralised authorities. Threshold and certificate based strategies may be used to bind routing claims to credentials and to mitigate forgeries. Digital signatures have been proposed [8] to guarantee non-repudiation at the cost of higher processing requirements to prevent wormhole and other attacks. Cryptographic approaches are effective against basic spoofing. However, they can be costly for resource constrained nodes because of the heavy computational and communication overheads they impose [9].

Trust, reward and neighbour surveillance strategies Many research use incentive mechanism or trust evaluation to promote collaboration and detect misbehaviour. The credit and nuglet techniques encourage cooperation in packet forwarding; however, they may incur additional administrative overhead and protocol complexity [10, 11]. Neighbour data forwarding activity is monitored using methods such as watchdog and pathrater techniques, which prefer routes with reliable nodes [12]. In studies [13-15], legitimacy tables and neighbour promiscuous monitoring have been used to remove nodes that show unusual packet drop patterns. Trust-based methods can detect selfish or inappropriate behaviours of nodes gradually; nevertheless, they are susceptible to collusion and may take longer observation periods, which might hinder responsiveness in dynamic contexts.

Secure versions of AODV and protocol level modifications. Several research have proposed improvements to AODV to combat black hole and similar routing assaults. Deng et al. [16] were the first to propose the use of Further-Request messages by intermediate nodes to verify the claims made in RREPs. Kurosawa et al. proposed utilise destination sequence analysis for dynamic learning to find contradictory RREPs [17]. Adaptive secure variants, e.g., A-SAODV, improve the robustness of the route discovery against manipulation via a mix of hash chains and filtering [18]. More research has employed RREQ filtering, rate limiting and blacklisting approaches [19, 20] to mitigate flooding and denial-of-service assaults. The protocol improvements increase its robustness, but at the price of additional control overhead and delay, especially when waiting for several RREPs or cross-validations.

Intrusion detection and machine-learning techniques. Intrusion detection systems and anomaly detection techniques can be used to analyse forwarding or traffic data in order to detect threats like flooding, gray/black holes and selective forwarding. Selective forwarding in Wireless Sensor Networks (WSN) with a restricted number of nodes can be recognised using Support Vector Machines (SVMs) and sliding-window approaches [21]. Support Vector Machine (SVM)-based intrusion detection systems and supervised algorithms have been applied and resulted in high true positive rates, which are used for the detection of Denial of Service (DoS) assaults and selective packet dropping [22]. One approach is to employ behavior-based algorithms and traceback techniques [23] to trace the sources of floods. The ML-IDS can reach high accuracy but it is restricted by the requirement to train on labelled data and the challenges of addressing idea drift in dynamic MANET topologies.

Specialized detection algorithms and recovery protocols. Several attack-specific detection methods are known, e.g., sequence number-based AODV black hole detection, local intrusion detection for AODV [24], low-false-positive routing recovery protocols [25], and query/ETX-based gray-hole detection [26]. Topology based analysis has been used to detect tunnelling and wormhole attacks [27]. These specialist systems excel at detecting individual threats, but they may not be as good at countering other forms of attacks or a coordinated effort involving multiple nodes.

WSN and energy-aware contributions (SEP and clustering). In order to improve the network lifetime, WSN researchers have been working on energy-efficient clustering techniques such as SEP that use node heterogeneity and weighted cluster-head selection. Although they do not offer route authentication by default, SEP and related approaches optimise the use of energy in order to increase the period of stability. Some efforts have tried to combine energy management with lightweight authentication to lower cryptographic costs [28], but integration with MANET routing security has been limited.

Summary and gap analysis. In summary, traditional MANET routing security techniques are separate procedures which include use of encryption for authenticity, trust and incentive schemes to promote collaboration, intrusion detection systems to detect anomalies and protocol hardening to build resilient systems. But there are downsides to each category as well: Cryptographic approaches could be too costly for restricted nodes, trust mechanisms might be inefficient or collusive, intrusion detection systems require training and can lead to false positives, and protocol changes can add latency and overhead. There is a lack of research that integrates energy-aware clustering (to promote stability and minimise overhead) and cryptographic validation of routing control packets to address both the performance and security at the same time in resource-constrained mobile environments.

In this work, we strive to achieve a practical trade-off between security, overhead, and lifetime of MANETs in the presence of black hole attacks. We combine SEP-based clustering with lightweight digital signatures in AODV to achieve: (i) faster authentication of routing control messages, (ii) localised verification and mitigation using cluster heads, and (iii) longer network lifetime through energy-efficient cluster formation.

2.1 Comparative analysis of existing methods

The existing MANET routing security measures can be divided into four broad categories: cryptographic techniques, trust-based mechanisms, intrusion detection systems and protocol-level updates. The cryptographic techniques ensure the authentication; however they have computational complexity not appropriate for resource-constrained nodes. Trust-based approaches are vulnerable to collusion attacks and are slow to converge as they are relied on observing the behaviour of nodes. While machine learning and intrusion detection systems are quite accurate in detection, they require a lot of data to train and have issues adapting to changing topologies. The protocol modification methods increase the resilience of routing, but pay the price of control overhead and delay.

The AODV+DS+SEP architecture combines energy-aware clustering and lightweight authentication enabling local verification with very low overhead. This integration solves the limits of the prior solutions by offering a trade-off between the scalability, energy efficiency and security as shown in Table 1.

Table 2 lists the main simulation parameters used in this investigation. All three generations of AODV were assessed with these settings, namely AODV+Digital Signature (AODV+DS), and AODV+DS+SEP.

Table 2. Core simulation parameters

4.1 Simulation setup & scenarios

Three different configurations of the protocols have been modelled:

The control group uses the basic AODV without any authentication and clustering method.

In AODV+DS protocol, nodes verify the signatures before accepting the routes, which means that all routing control packets (RREQ, RREP and RERR) are encrypted.

AODV + DS + SEP - SEP is used to choose the energy-efficient cluster heads; cluster heads help in verifying signatures and local routes to reduce global overhead by localising the validation.

Each run lasted 900 sec. A velocity of 12 m/s and a pause time of 110 seconds were set. Data transmission was done via TCP and packet sizes were computed according to the given exponential distribution. We deployed malicious nodes acting as blackhole.

4.2 Simulation scenarios (steps)

Step 1. The network initialisation as indicated in Figure 7 involves randomly deploying 100 nodes within the field and placing the base station at coordinates (100,100).

Step 2. Normal operation (no attack) — nodes run AODV and exchange RREQ/RREP normally as in Figure 8.

Step 3. Attack injection — introduce one or more malicious nodes that immediately reply to RREQs with forged RREPs (high sequence number, low hop count) and then drop data packets. This is shown in Figure 9.

Step 4. Apply digital signatures — attach a lightweight digital signature to routing control packets; nodes discard unsigned/invalid RREPs. Signatures are rotated/updated each round Figure 10.

Step 5. Apply SEP clustering + DS — elect cluster heads using SEP weighted probabilities and perform local signature verification at CHs Figure 11.

Figure 7. Network simulation for 100 nodes

Figure 8. Transmission of data packets among nodes

Figure 9. Malicious nodes detected in the network (star marker)

Figure 10. Digital signature identifiers per node

Figure 11. Stable Election Protocol (SEP) cluster formation and Cluster Head (CH) distribution

4.3 Performance metrics and data collection

We evaluate:

• Packets sent (generated by sources)

• Packets received (successfully delivered to destinations)

• Packet delivery ratio (PDR) = received / sent

• Packet drop count (packets lost due to black hole or other reasons)

• Effect of SEP on energy balance / node lifetime (qualitative in this paper; energy plots included)

4.4 Results

4.4.1 AODV vs. AODV + Digital Signature (time-series)

Table 3 shows the time-slot-wise packets sent and received for baseline AODV and AODV+DS.

Table 3. Performance (AODV vs. AODV + DS)

Figure 12 presents a Time-series plot: packets sent vs. received (AODV, AODV+DS). Observations are:

• AODV suffers significant packet loss under black hole injection (low received counts).

• AODV+DS shows improvement in some time-slots (higher received counts), indicating that signature verification prevents some forged RREPs.

• In several time-slots AODV received more packets than AODV+DS (slots 6-9 in the provided numbers). This can occur if signature operations delay route setup or if signatures cause legitimate RREPs to be temporarily rejected due to key-sync delays—these practical caveats should be noted.

Figure 12. Time-series plot: packets sent vs. received (AODV, AODV+DS)

4.4.2 AODV + DS vs. AODV + DS + SEP (time-series)

Table 4 shows the time-slot-wise packets sent and received for AODV + DS vs. AODV + DS + SEP (time-series).

Table 4. Performance (AODV + DS vs. AODV + DS + SEP)

Figure 13 Shows the aggregated time series: packets received AODV+DS and AODV+DS+SEP. Comments include:

Figure 13. Combined time-series: packets received for AODV+DS and AODV+DS+SEP

The AODV+DS+SEP setup produces much higher delivery rates in all the reported slots, frequently delivering all 24 packets per slot. Black hole nodes seem to pose no problem in these executions due to SEP's clustering and CH-based verification, which identify or isolate detrimental RREPs prior to route formation. Energy-aware cluster head selection indirectly improves packet delivery ratio by minimising route churn and preventing overload on vulnerable nodes. Data were aggregated in time-slots (1.10) to produce the step-wise tables and Figure 14 reported packet delivery ratio.

Figure 14. Packet delivery ratio with 95% confidence intervals

4.5 Statistical validation

We repeated the simulations ten times with different random seeds to ensure the stability of the results. The statistics are expressed as mean ± standard deviation and the 95% confidence interval (CI) is calculated as shown in Eq. (2):

$\begin{gathered}C I=\bar{X} \pm 1.96 \times \frac{\sigma}{\sqrt{n}} \\ \text { for } \mathrm{n}=10 .\end{gathered}$                (2)

Table 5 consistently shows that AODV + DS + SEP has better packet delivery with reduced volatility. This is promising.